Where the scope takes in virtual sites, the assessment documentation notes that virtual sites are included and identifies the activities performed at them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.